--show-suppressed: cannot unmarshal field ModifiedFinding.Results.ExperimentalModifiedFindings.Finding of type.finding

[joda-work]

Description

The problem likely is caused by commit #7382

Run docker run --rm -it aquasec/trivy:latest -c -v "$(pwd)/vex:/vex/" -v "$(pwd)/reports:/reports" -v "$(pwd)/configs/centos:/root"

trivy -q image --vex /vex/fixed-in-centos.vex --show-suppressed -f json -o /reports/trivyFull.json --exit-code 0 centos@sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f432b177
trivy -q convert --show-suppressed -f template --template "@contrib/html.tpl" -o /reports/trivyFull.html --exit-code 0 /reports/trivyFull.json
2024-09-06T14:42:39Z    FATAL   Fatal error     json decode error: json: cannot unmarshal object into Go struct field ModifiedFinding.Results.ExperimentalModifiedFindings.Finding of type types.finding

Content vex/fixed-in-centos.vex:

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://openvex.dev/docs/public/vex-1ae5baba83550fe79e7deb6068444b3e1e3d729051c2706cd2f0af2487414eb0",
  "author": "[email protected]",
  "timestamp": "2024-09-05T08:14:21.324912089Z",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2024-6345"
      },
      "timestamp": "2024-09-05T08:01:21.324912969Z",
      "products": [
        {
          "@id": "pkg:pypi/setuptools"
        },
        {
          "@id": "pkg:rpm/centos/[email protected]"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "pypi / pip is unused"
    }
  ]
}

Content configs/centos/trivy.yaml:

scan:
  scanners:
    - vuln
    - misconfig

Desired Behavior

Unmarshal works with --show-suppressed for:

grep ExperimentalModifiedFindings -A 40 /reports/trivyFull.json
/reports/trivyFull.json:43831:
      "ExperimentalModifiedFindings": [
        {
          "Type": "vulnerability",
          "Status": "not_affected",
          "Statement": "vulnerable_code_not_in_execute_path",
          "Source": "/vex/fixed-in-centos.vex",
          "Finding": {
            "VulnerabilityID": "CVE-2024-6345",
            "VendorIDs": [
              "RHSA-2024:5530"
            ],
            "PkgID": "[email protected]",
            "PkgName": "platform-python-setuptools",
            "PkgIdentifier": {
              "UID": "dd4edfdcd8964cc3"
            },
            "InstalledVersion": "39.2.0-6.el8",
            "FixedVersion": "39.2.0-8.el8_10",
            "Status": 3,
            "Layer": {
              "Digest": "sha256:a1d0c75327776413fa0db9ed3adcdbadedc95a662eb1d360dad82bb913f8a1d1",
              "DiffID": "sha256:74ddd0ec08fa43d09f32636ba91a0a3053b02cb4627c35051aff89f853606b59"
            },
            "SeveritySource": "redhat",
            "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-6345",
            "Title": "pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools",
            "Description": "...",
            "Severity": "HIGH",
            "CweIDs": [
              "CWE-94"
            ],
            "VendorSeverity": {
...
              "redhat": 3,
...
            },
            "CVSS": {
              "bitnami": { .. },
              "ghsa": { .. },
              "redhat": {
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "V3Score": 8.8
              }
            },
            "References": [
              "https://access.redhat.com/errata/RHSA-2024:5534",
                ...
            ],
            "PublishedDate": "2024-07-15T01:15:01.73Z",
            "LastModifiedDate": "2024-07-15T13:00:34.853Z"
          }
        }

Actual Behavior

2024-09-04T15:16:56Z FATAL Fatal error json decode error: json: cannot unmarshal object into Go struct field ModifiedFinding.Results.ExperimentalModifiedFindings.Finding of type types.finding

Reproduction Steps

1. `
docker run --rm -it aquasec/trivy:latest -c -v "$(pwd)/vex:/vex/" -v "$(pwd)/reports:/reports" -v "$(pwd)/configs/centos:/root"`
2. Inside docker: `$ trivy -q image --vex /vex/fixed-in-centos.vex --show-suppressed -f json -o /reports/trivyFull.json --exit-code 0 centos@sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f432b177`
3. Inside docker: `trivy -q convert --show-suppressed -f template --template "@contrib/html.tpl" -o /reports/trivyFull.html --exit-code 0 /reports/trivyFull.json`

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Debug Output

trivy --debug convert --show-suppressed -f template --template "@contrib/html.tpl" -o /reports/trivyFull.html --exit-code 0 /reports/trivyFull.json
2024-09-06T15:17:26Z    DEBUG   No plugins loaded
2024-09-06T15:17:26Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-09-06T15:17:26Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2024-09-06T15:17:26Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2024-09-06T15:17:26Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-09-06T15:17:26Z    FATAL   Fatal error
  - json decode error:
    github.com/aquasecurity/trivy/pkg/commands/convert.Run
        /home/runner/work/trivy/trivy/pkg/commands/convert/run.go:32
  - json: cannot unmarshal object into Go struct field ModifiedFinding.Results.ExperimentalModifiedFindings.Finding of type types.finding

Operating System

Ubutnu 20.04 / docker

Version

$ trivy --version
Version: 0.55.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-09-06 06:12:00.246200522 +0000 UTC
  NextUpdate: 2024-09-06 12:12:00.246200382 +0000 UTC
  DownloadedAt: 2024-09-06 10:01:26.444626537 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-09-06 01:08:46.080314586 +0000 UTC
  NextUpdate: 2024-09-09 01:08:46.080314415 +0000 UTC
  DownloadedAt: 2024-09-06 10:01:56.762670262 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @joda-work
Thanks for your report!

Created #7461 for this task.

Regards, Dmitriy